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0 Multiplex control system with diagnosis function. 



0 A multiplex control system comprises a plurality 
of control apparatuses (1), test signal generators (J1) 
provided, respectively, for the control apparatuses 
(1) for the purpose of internal diagnosis thereof, 
signal selectors (10) each for selecting a signal to 
operate a device (13) under control from the signals 
produced by the control apparatuses, and diagnosis 
units (2) each for deciding presence or absence of 
abnormality in the associated signal selector with the 
aid of the signals inputted to the signal selector and 
the output signal therefrom. 
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@ Multiplex control system with diagnosis function. 

@ A multiplex control system comprises a plurality of control 
apparatuses (1), test signal generators (J1) provided, respec- 
tively, for the control apparatuses (1) for the purpose of internal 
diagnosis thereof, signal selectors (10) each for selecting a 
signal to operate a device (13) under control from the signals 
produced by the control apparatuses, and diagnosis units (2) 
each for deciding presence or absence of abnormality in the 
associated signal selector with the aid of the signals inputted to 
the signal selector and the output signal therefrom. 
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MULTIPLEX CONTROL SYSTEM 



The present invention generally relates to a 
multiplex control system and more particularly to the 
multiplex control system imparted with diagnosis 5 
function. 

In general, the control system to which a great 
Importance is put is implemented with redundancy 
by multiplexing the control in an effect to enhance 
the reliability of the control system as a whole. As a 10 
typical example of such control systems, there can 
be mentioned a nuclear reactor protecting system in 
a nuclear power plant in which control channels are 
provided in quadruple in order to ensure an 
extremely high reliability. In this connection, ref- 15 
erence may be made, for example, to U.S. Patent 
No. 4,517,154 and EP-A-180085 which are both 
concerned with such type of nuclear reactor protect- 
ing system as mentioned above. More specifically, in 
the nuclear reactor protecting system disclosed in 20 
these literatures, control systems or channels are 
provided in quadruple, wherein control signals 
outputted from these four control channels are 
inputted to a majority decision circuit configured in 
the form of a 2-out-of-4 logic voting circuit so that a 25 
device subject to control such as, for example, a 
valve is actuated on the basis of the control signal 
selected by the majority decision circuit. In the case 
of the nuclear reactor protecting system disclosed in 
the abovementioned U.S. Patent, a diagnosis unit is 30 
provided for diagnosing the function of all the 
quadruplexed control channels. In more concrete, a 
single diagnosis unit produces test signals sequen- 
tially to the quadruplexed control channels for 
making decision as to the presence or absence of 35 
abnormality or malfunction in each of the control 
channels. 

In the nuclear reactor protecting system of the 
structure mentioned above, occurrence of abnor- 
mality (malfunction) in the diagnosis unit itself might 40 
lead to such utterly undesirable situation in which all 
the quadruplexed control channels could simulta- 
neously output erroneous test signals, resulting in 
that the device subject to the control might be 
inadvertently or erroneously operated. It is further 45 
noted that in this known nuclear reactor protecting 
system, the abnormality decision is not performed 
for the majority decision circuit, i.e. the signal 
selecting circuit itself. 

It is thus desirable to enable one to provide an 50 
improved multiplex control system in which even in 
the event that abnormality should occur in at least 
one of test signal generating means and a mechan- 
ism for applying the test signal for the diagnosis of 
abnormality as outputted from the test signal 55 
generating means to the signal selecting means, the 
possibility that a device to be controlled might be 
affected by such abnormality can be reduced to a 
possible minimum, while making it possible to 
diagnose the signal selecting means (majority 60 
decision circuit) with regard to the presence of 
abnormality. 

There is provided according to an aspect of the 



present invention a multiplex control system which 
comprises a plurality of test signal generating means 
provided, respectively, in correspondence with a 
plurality of control apparatuses (also referred to as 
controller) installed in parallel with one another for 
producing respective test signals for the diagnosis 
of abnormality, at least one signal selecting means 
for selecting from the signals produced by the 
plurality of control apparatuses a signal for operating 
a device to be controlled, and a plurality of diagnosis 
units for deciding the presence or absence of 
abnormality in the signal selecting means on the 
basis of the signals inputted to the signal selecting 
means and the signal outputted therefrom. 

By virtue of such arrangement that the test signals 
for the diagnosis of abnormality as outputted from all 
the signal generating means provided in one-to-one 
correspondence with the plurality of control appara- 
tuses are inputted to the signal selection means 
which is so designed to select the proper input 
signal from a number of the input signals, the device 
subject to the control (e.g. a valve being monitored) 
can be protected against the influence of an 
abnormal test signal, even when such abnormal test 
signal produced due to occurrence of abnormality in 
at least one of the test signal generating means and 
a mechanism for applying the outputted abnormality 
diagnosing test signal to the signal selecting means 
circuit should be applied to the signal selecting 
means. Further, since each of the diagnosis units 
provided in correspondence with the plurality of 
control apparatuses performs the diagnosis with 
regard to the abnormality of the signal selecting 
means with the aid of all the signals inputted to the 
signal selecting means and the output signals of 
individual logical elements constituting the signal 
selecting means, the abnormality diagnosis of the 
signal selecting means can be carried out in a 
facilitated manner. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a schematic diagram showing an 
arrangement of a triplex control system accord- 
ing to an exemplary and preferred embodiment 
of the present invention; 

Fig. 2 is a circuit diagram showing a structure 
of a majority decision circuit employed in the 
control system shown in Fig. 1 ; 

Fig. 3 is a circuit diagram showing a structure 
of diagnosis unit employed in the control 
system shown in Fig. 1 ; 

Fig. 4 illustrates in a flow chart a processing 
procedure executed by the diagnosis unit; 

Fig. 5 is a view for illustrating signal patterns 
stored in the ROM of the diagnosis unit shown 
in Fig. 3 and indicating the normal state of the 
majority decision circuit; 

Fig. 6 shows in a timing diagram the wave- 
forms of test signals outputted from change- 
over switches shown in Fig. 1 ; 
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Fig. 7 is a schematic circuit diagram showing 
another configuration of the majority decision 
circuit; 

Fig. 8 is a view for illustrating functional 
arrangement of the diagnosis unit shown in 
Fig. 3; 

Fig. 9 is a schematic diagram showing a 
general arrangement of a triplex control system 
according to another embodiment of the pres- 
ent invention; 

Fig. 10 is a schematic circuit diagram show- 
ing a structure of a latch device employed in the 
system shown in Fig. 9; 

Fig. 11 is a schematic circuit diagram show- 
ing a structure of a diagnosis unit employed in 
the system shown in Fig. 9; 

Figs. 12 and 13 show flow charts for illustrat- 
ing processing procedures executed by the 
diagnosis unit in t he system shown in Fig. 1 1 ; 

Fig. 14 is a view illustrating functional ar- 
rangement of the diagnosis unit employed in 
the system shown in Fig. 1 1 ; 

Fig. 15 is a schematic circuit diagram show- 
ing a structure of the latch device according to 
another embodiment; 

Fig. 16 is a schematic diagram showing a 
general arrangement of a triplex control system 
according to still another embodiment of the 
present invention; 

Fig. 17 is a circuit diagram showing a 
structure of a control apparatus employed in 
the system shown in Fig. 16; 

Fig. 18 is a circuit diagram showing a 
structure of the diagnosis unit employed in the 
system shown in Fig. 16; 

Fig. 19 is a flow chart illustrating a processing 
procedure executed by the control apparatus 
shown in Fig. 17; 

Fig. 20 is a flow chart illustrating a processing 
procedure executed by the diagnosis unit 
shown in Fig. 18; 

Fig. 21 is a view showing a functional 
arrangement of the diagnosis unit shown in 
Fig. 18; 

Fig. 22 is a schematic diagram showing a 
general arrangement of a triplex control system 
according to a further embodiment of the 
present invention; 

Fig. 23 is a schematic diagram showing a 
general arrangement of a quadruplex control 
system according to a still further embodiment 
of the present invention; 

Fig. 24 is a circuit diagram showing a 
structure of a majority decision circuit em- 
ployed in the system of Fig. 23; 

Fig. 25 is a circuit diagram of a diagnosis unit 
employed In the system of Fig. 23; 

Fig. 26 is a view illustrating a processing 
procedure executed by the diagnosis unit of the 
system shown in Fig. 25; 

Fig. 27 is a timing chart illustrating waveforms 
of the test signals outputted by change-over 
switches employed in the system of Fig. 23; 

Fig. 28 is a view showing, listed in a table, 
those relays which can be monitored by the 



signal detectors shown in Fig. 24; 

Fig. 29 is a view showing signal patterns 
indicative of normal state of the majority 
decision circuits in the system of Fig. 23; 
5 Fig. 30 is a view for illustrating a functional 

arrangement of the diagnosis unit employed in 
the system of Fig. 23; 

Fig. 31 is a circuit diagram showing another 
exemplary structure of the majority decision 
10 circuit which can be employed in the system 

shown in Fig. 23. 
Now, the present invention will be described in 
detail in conjunction with a preferred and exemplary 
of the multiplex control system imparted with a 
15 diagnosis function by reference to Fig. 1. The 
multiplex control system shown in this figure is 
implemented in the form of a triplex control system, 
by way of example. 
The triplex control system shown in Fig. 1 includes 
20 three control apparatuses (controllers) 1A, 1B and 
1C and majority decision circuits 10A, 10B and 10C, 
being disposed in parallel with one another. In the 
case of the instant embodiment, the control appara- 
tus 1A is associated with the majority decision 
25 circuit 1 0A in a pair. Similarly, the control apparatus 
1B is paired with the majority decision circuit 10B, 
while the control apparatus 1C is associated with the 
majority decision circuit 10C. Besides, the control 
apparatus 1 A is provided with a diagnosis unit 2A in 
30 a paired form. Similarly, the control apparatus 1B is 
paired with a diagnosis unit 2B, while the control 
apparatus 1C is provided with a diagnosis unit 2C. In 
other words, the diagnosis units are provided in a 
number corresponding to the redundancy with 
35 which the control system is implemented. 

The control apparatus 1A is connected to a 
stationary contact 4A of a change-over switch SWA 
which includes the other stationary contacts 4B and 
4C and a movable contact 4D having one end 
40 connected to the stationary contact 4C. The other, 
end of the movable contact 4D is adapted to be 
exchangeably connected to either the stationary 
contact 4A or 4B. Change-over switches SWB and 
SWC connected to the control apparatuses 1B and 
45 1C, respectively, are implemented in the same 
structure as the change-over switch SWA. A wiring 
conductor 19A connected to the stationary contact 
4C of the change-over switch SWA is connected to 
the majority decision circuit 10A. Similarly, wiring 
50 conductors 19B and 19C connected to the change- 
over switches SWB and SWC, respectively, lead to 
the majority decision circuits tOA to 10C, respec- 
tively. 

Fig. 2A shows an exemplary circuit configuration 
55 of the majority decision circuit 1 0A. As will be seen in 
this figure, the majority decision circuit 10A is 
composed of logical sum elements or OR gates 5A 
to 5C connected in parallel and a logical product 
element or AND gate 6A having inputs connected to 
60 the outputs of the OR gates 5A to 5C, respectively. 
In other words, the majority decision circuit 10A is 
implemented in the form of a 2-out-of-3 voting logic 
device. The input terminals of the OR gate 5A are 
connected to the wiring conductors 19A and 19B, 
65 respectively. Similarly, the input terminals of the OR 
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gate 5B are connected to the wiring conductors 19B 
and 19C, respectively, while those of the OR gate 5C 
are connected to the wiring conductors 19C and 
19A, respectively. It should be mentioned that the 
majority decision circuit 10B and 10C are im- 
plemented in the same configuration as the majority 
decision circuit 10A. As described previously, each 
of the majority decision circuits 10A, 10B and 10C 
realizes the 2-out-of-3 voting logic. The output 
terminal of the AND gate 6A which constitutes the 
output terminal of the majority decision circuit 10A is 
connected to a valve 13A to be controlled through a 
wiring conductor 20A. In the similar manner, a valve 
13 to be controlled is connected to the output 
terminal of the majority decision circuit 10B through 
a wiring conductor 20B, while a valve 13C subject to 
the control is connected to the majority decision 
circuit 10C by way of a wiring conductor 20C. 

Turning to Fig. 1, a signal detector 7A is provided 
in association with the wiring conductor 19A leading 
to the input of the majority decision circuit 10A. 
Further, a signal detector 8A is provided for the 
wiring conductor 19B while a signal detector 9A is 
provided in association with the wiring conductor 
19C. In the similar manner, signal detectors 7B, 8B 
are provided in association with the wiring conduc- 
tors 19A, 19B and 19C, respectively, on the input 
side of the majority decision circuit 10B, while signal 
detectors 7C, 8C and 9C are provided for the 
conductor 19A, 19B and 19C, respectively, on the 
input side of the majority decision circuit 10C, as is 
shown in Fig. 1. It is also noted that signal detectors 
11 A, 11B and 11C are provided in association with 
wiring conductors 20A, 20B and 20C connected to 
the output terminals of the majority decision circuit 
10A, 10B and 10C, respectively. Besides, signal 
detectors 12A, 12B and 12C are provided on the 
output sides of the OR gates 5A, 5B and 5C, 
respectively, in the majority decision circuit 10A, as 
shown in Fig. 2. It should be understood that these 
sorts of the signal detectors 12A, 12B and 12C are 
also provided in the majority decision circuits 10B 
and 10C, respectively, in the same arrangement as in 
the case of the majority decision circuit 10A. Each of 
the signal detectors mentioned above may be 
constituted by a device designed to measure directly 
the potential at the associated circuit point for 
detecting a signal or alternatively by a device 
designed to measure the current flowing through the 
associated circuit point in a contactless manner. It is 
however preferred that a contactless current trans- 
former typical of the latter should be employed as 
the signal detector because the current transformer 
type signal detector is capbie of measuring the 
current regardless of whether the current to be 
measured is an AC or a DC current. Besides, 
because of the contactless measurement, any 
failure in the signal detector itself would exert no 
adverse influence to the associated control channel. 
In other words, the triplex control system need not 
be operated in a common mode even when failure 
occurs in any one of the signal detectors, to 
advantage. More preferably, the contactless signal 
detector can be constituted by a CT current sensor 
disclosed, for example, in a Japanese literature 
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entitled "Sensor Interfacing*, No. 3, pp. 111-116 
(published Feb. 2, 1987). In particular, it is noted that 
the CT current sensor disclosed in the above 
literature incorporates no power supply source, 
5 which is very favorable to the triplex control system 
in which the common mode should be evaded to the 
limit of possibility. 

The signal detectors 12A, 12B and 12C serve as 
means for detecting the output signals of the logical 

10 elements (i.e. OR gates 5A, 5B and 5C) of the 
majority decision circuit 10A to thereby output 
detection signals designated collectively by 17A. On 
the other hand, the signal detector 11A serves as a 
means for detecting the output signal of the logical 

15 element (AND gate 6A) constituting other part of the 
majority decision circuit 10A to thereby output a 
detection signal designated by a symbol 18A in 
Fig. 1. The signal detectors 7A, 8A and 9A serve to 
detect three signals (i.e. signals a, b and c) inputted 

20 to the majority decision circuit 10A through the 
wiring conductors 19A to 19C, respectively, to 
thereby output signals designated collectively by a 
symbol 16A. The detection signals 16A, 17A and 18A 
are supplied to the diagnosis unit 2A. Similarly, the 

25 detection signals 16B, 17B and 18B produced, 
respectively, by the signal detectors 7B to 9B, the 
signal detectors 12A to 12C incorporated in the 
majority decision circuit 10B and the signal detector 
1 1 B are supplied to the diagnosis unit 2B. On the 

30 other hand, the detection signals 16C, 17C and 18C 
produced, respectively, by the signal detectors 7C 
to 9C, the signal detectors 12A to 12C incorporated 
in the majority decision circuit 10C and the signal 
detector 11 C are supplied to the diagnosis unit 2C. 

35 Referring to Fig. 3, the diagnosis unit 2A is 
constituted by a microprocessor (microcomputer) 
and includes a read-only memory or ROM 24, a 
central processing unit (CPU) 25, a random access 
memory (RAM) 26, an output circuit 27 and an input 

40 circuit 28, wherein these components are intercon- 
nected by an address bus 29 and a data bus 30. The 
detection signals 16A, 17A and 18A mentioned 
above are applied to the input circuit 28. The ROM 29 
serves to store a processing procedure illustrated in 

45 Fig. 4 and the states of the individual detection 
signals (shown in Fig. 5) which must make appear- 
ance in the normal operation. The CPU 25 executes 
arithmetic operations in accordance with the pro- 
cessing procedure illustrated in Fig. 4. The RAM 26 

50 serves to store temporarily the data inputted 
through the input circuit or interface 28 as well as the 
results of the arithmetic operation performed by the 
CPU 25. The wiring conductor 3A, 21A and 22B are 
connected to the output circuit or interface 27. More 

55 specifically, the wiring conductor 3A is connected to 
a display unit 23 for transmitting information con- 
cerning the results of the abnormality decision made 
by the diagnosis unit 1 0A to a display unit 23. The 
wiring conductor 21 A is connected to the stationary 

60 contact 4B of the change-over switch SWA and 
carries a test signal S. The wiring conductor 22B is 
connected to the change-over switch SWA and 
carries a test command signal CH. 
The other diagnosis unit 2B and 2C are realized in 

65 the same structure as the diagnosis unit 2A and 
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serve for the same functions as those of the 
diagnosis unit 2A, which wi!i be described in more- 
detail later on. The wiring conductors 3B, 21 B and 
22B are connected to the output interface 27 of the 
diagnosis unit 2B. The other end of the wiring 
conductor 3B is connected to the display unit 23, 
while that of the wiring conductor 21 B is connected 
to the stationary contact 4B of the change-over 
switch SWB. Further, the wiring conductor 22B is 
also connected to the change-over switch SWB as 
shown in Fig. 1. The wiring conductor 3C connected 
to the display unit 23, the wiring conductor 21 C 
connected to the stationary contact 4B of the 
change-over switch SWC and the wiring conductor 
22C also connected to the change-over switch SWC 
have respective other ends connected to the output 
circuit 28 of the diagnosis unit 2C. The signals 
carried by the wiring conductors 3B and 3C, 
respectively, are same as the signal transmitted 
through the wiring conductor 3A. Further, the 
signals transmitted through the wiring conductors 
21 B and 21 C t respectively, are same as the signal 
transmitted through the wiring conductor 21 A, while 
the signals on the wiring conductors 22B and 22C 
are same as the signal carried by the wiring 
conductor 22A. 

Next, description will be directed to the operation 
of the triplex control system according to the instant 
embodiment of the present invention. The functions 
or operations of the control apparatuses or control- 
lers, the diagnosis units, the change-over switches 
and the majority decision circuits 10 each provided 
in triplex are identical among the three control 
channels. Accordingly, the following description 
concerning operation of the control system wil! be 
made by reference to the channel including the 
control apparatus 1A, the diagnosis unit 2A and the 
majority decision circuit 10, being understood that 
the same applies true to the corresponding compo- 
nents of the other channels. 

The control apparatus or controller 1A is supplied 
as the input signal thereto with measurement signals 
produced by sensors (not shown) installed in the 
plant to thereby output a signal a for controlling the 
opening degrees of the valves 13A, 13B and 13C, 
respectively. The change-over switch SWA is main- 
tained in the state in which the movable contact 4D is 
connected to the stationary contact 4A so long as 
the test command signal CH outputted from the 
diagnosis unit 2A is absent. Consequently, the signal 
a outputted from the control apparatus 1A is 
supplied to the input of the majority decision circuit 
10A by way of the change-over switch SWA and the 
wiring conductor 19A. At the same time, a signal b 
outputted from the control apparatus 1B is supplied 
to the input of the majority decision circuit 10A. 
Besides, a signal c produced by the control 
apparatus 1C is also supplied to the majority 
decision unit 10A. It should be noted that the signals 
a, b and c are also supplied to the majority decision 
circuit 10B and 10C simultaneously. The signals a, b 
and c are digital signals each including logic "0° and 
logic "V levels. 

The majority decision circuit 10A constitutes a 
sort of signal selecting means arranged so as to 



decide whether the three input signals coincide with 
one another to thereby output as a correct control 
signal which corresponds to at least two inputs 
which coincide with each other. (Same holds true for 

5 the majority decision circuits 10B and 10C.) More 
specif i cally, when at least two of the three input 
signals a, b and c are logic "1 the majority decision 
circuit 10A selects the logic "1" signal as the control 
signal for the valve 13A. On the other hand, when at 

10 least two of the three input signals a, b and c are 
logic B 0", the majority decision circuit 10A selects 
the signal of logic "0 n as the control signal to be 
supplied to the valve 13 A. When the signal outputted 
from the majority decision circuit 10A is logic "1", the 

15 valve 13A is opened, while it is closed when the 
output signal from the majority decision circuit 10A 
is logic "0". 

The operation described above represents a 
normal control operation of the triplex control 

20 system according to the instant embodiment of the 
invention. The following description will be turned to 
the diagnosis function for the majority decision 
circuits (10) of the triplex control system for 
deciding the presence or absence of abnormality in 

25 these majority decision circuits. The diagnosis for 
determining the presence or absence of abnormality 
is performed by the diagnosis units 2A, 2B and 2C, 
respectively. Fig. 4 shows a processing procedure 
which can be executed by the diagnosis unit 2A to 

30 this end. Of course, the processing procedure 
shown in Fig. 4 also applies valid to the diagnosis 
unit 2B by reading "signals 16A to 18A a occurring in 
Fig. 4 as "signal 16B to 18B", respectively. Similarly, 
the processing procedure performed by the diag- 

35 nosis unit 2C corresponds to the procedure shown 
in Fig. 4 by replacing "signals 16A to 18A" by "signal 
16C to 18C D , respectively. 

In the diagnosis unit 2A, the processing based on 
the procedure illustrated in Fig. 4 and stored in the 

40 ROM 21 is executed by the CPU 25. At first, the CPU 
25 outputs the test signal S of logic "0" on the wiring 
conductor 21A for diagnosing the triplex control 
system (more specifically, the majority decision unit 
and the diagnosis unit) as to the presence of 

45 abnormality, while outputting the test command 
signal CH onto the wiring conductor 22A (step 31 in 
Fig. 4). The outputting of the test signal S of logic "0° 
is equivalent to the state in which a pulse-like test 
signal S for the diagnosis of abnormality as de- 

50 scribed hereinafter is not outputted. The test signal 
S of the logic "O" is applied to the stationary contact 
4B of the change-over switch SWA. In this state, the 
movable contact 4D of the change-over switch SWA 
is connected to the stationary cotact 4B in response 

55 to the test command signal CH. Upon Interruption in 
the outputting of the test command signal CH, the 
movable contact 4D of the change-over switch SWA 
is connected to the stationary contact 4A. The time 
interval or period during which the movable contact 

60 4D remains in the state connected to the stationary 
contact 4B is equal to a pulse width or duration To of 
the pulse-like test signal S described hereinafter. By 
virtue of this feature, the valve 13A opened in 
response to the control signals (of logic "1") issued 

65 by the control apparatuses 1A and 1B is prevented 
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from being closed even when the test signals of 
logic "0" contained in the signals a, b and c should 
overlap each other. The change-over switch SWA 
responds to the input of the test command signal CH 
by outputting the test signal S of logic "0" as the 
signal a in place of the output signal from the control 
apparatus 1A. This signal a is supplied to the 
majority decision circuits 10B and 10C as well. At a 
step 32, the diagnosis unit 2A fetches the following 
data signals. In other words, the detection signals 
16A produced by the signal detectors 7A, 8A and 9A, 
the detection signals 17A outputted from the signal 
detectors 12A, 12B and 12C incorporated in the 
majority decision circuit 10A and the signal 18A 
outputted from the signal detector 11A are once 
loaded in the RAM 26 by way of the input circuit 28 
and the data bus 30. The CPU 25 compares the input 
signals 16A to 1 8A with the output patterns (patterns 
labelled No. 1 to 8 shown in Fig. 5) of these signals in 
the normal state of the majority decision circuit 10A 
(step 33). Subsequently, decision is made as to the 
presence or absence of abnormality in the majority 
decision circuit 10A (step 34). In this conjunction, it 
is assumed, by way of example, that the detection 
signals of the signal detectors 7A to 9A (the input 
signals to the majority decision circuit 10A) are all of 
logic "0" as in the case of the pattern No. 1 shown in 
Fig. 5. It is then decided that the majority decision 
circuit 10A functions normally without suffering from 
any abnormality when the detection signals of the 
signal detectors 12A to 12C and 18A (output signal 
of the individual logical elements constituting the 
majority decision circuit 10A) are all of logic "0". On 
the other hand, when the detection signal of the 
signal detector 12B is logic "T, this means that 
discrepancy with the pattern No. 1 shown in Fig. 5 is 
present, in that case, it is decided at a step 34 that 
the OR gate 5B of the majority decision circuit 10A 
suffers from abnormality. Next assuming, by way of 
another example, that the output signal 18A of the 
signal detector 11 A is logic "1". there exists 
discrepancy with the pattern labelled No. 1 (Fig. 5). 
Thus, decision can be made to the effect that 
abnoramlity is present in the AND gate 6A of the 
majority decision circuit 10A. When it is decided at 
the step 34 that abnormality is present, the compo- 
nent of the majority decision circuit 10A which 
suffers from abnormality is informed to the display 
unit 23 by way of the output circuit 27 and the wiring 
conductor 3A (step 36). The display unit 23 responds 
thereto by display the abnormal component of the 
majority decision circuit 10A. An alarm may also be 
produced at the step 36. 

When the decision made at the step 34 results in 
the absence of abnormality, the processing proce- 
dure proceeds to a step 35. In this step 35, the 
pulse-like test signal S including a row of logic "0", 
"1 " and "0" levels in this sequence is issued from the 
output circuit 27 of the diagnosis unit 2A to be 
applied by way of the wiring conductor 21 A to the 
change-over switch SWA together with the test 
command signal CH, whereupon the change-over 
switch SWA transmits the pulse-like test signal S as 
the signal a to each of the majority decision circuits. 
At a step 32A, the detection signals 16A to 18A 



detected by the respective signal detectors are 
inputted simultaneosuly (i.e. the signals detected at 
a same time point are inputted) to the diagnosis unit 
2A be stored in the RAM 26 as in the case of the step 
5 32 described previously. At the same time, the 
number of times the detection signals 16A to 18A 
are inputted in succession to the output of the 
pulse-like test signal S are counted at the step 32A, 
wherein the counted number is stored in the RAM 

10 26. At a succeeding step 37, each of the signals 16A 
outputted from the signal detectors 7A to 9A, 
respectively, is checked as to whether the signal 16A 
has undergone any change when compared with the 
state of the same signal inputted at the last 

15 (preceding) time point. The signal 16A undergone 
the change is stored in the RAM 26. It is however to 
be noted that the signal 16A undergone no change 
may alternatively be stored in the RAM 26. In steps 
33A and 34A, the processings similar to those 

20 described above in conjunction with the steps 34 
and 35 are performed. The processing at the step 37 
may be executed in succession to the step 34A. 

At a step 38, the number of times the detection 
signals 16A to 18A are inputted to be stored in the 

25 RAM 26 is compared with a preset number of times, 
whereby decision is made as to whether the number 
of times the signals are inputted has attained the 
predetermined number. Unless the number of times 
the detection signals were inputted has reached the 

30 predetermined number, the processing steps 32A, 
37, 33A, 34A and 38 are repeatedly executed. When 
it is decided at the step 38 that the number of times 
the signals were inputted has attained the predeter- 
mined number, then a step 39 is performed. At this 

35 step 39, it is decided whether there exists among the 
three signals 16A detected and stored in the RAM 26 
at the steps 37 any signal that has undergone no 
change. This decision in its essence is equivalent to 
the decision made as to the presence or absence of 

40 the abnormal diagnosis unit which produces con- 
stantly the test signal S undergone no change 
among the diagnosis unit 2A, 2B and 2C which 
output the respective pulse-like test signals S, the 
reason for which will be explained in detail later on. In 

45 case the change had occurred in all of the three 
signals 16A until the number of the times the signals 
are inputted has attained the predetermined number 
or count, this means that all of the diagnosis units 
2A, 2B and 2C function normally. In this case, the 

50 processing at the step 31 is resumed, whereupon 
the succeeding steps are executed sequentially. On 
the other hand, when it is decided at the step 39 that 
there exists the signal 16A undergone no change, 
abnormality of the diagnosis unit outputting the test 

55 signal S onto the wiring conductor (at least one of 
the wiring conductors 19A, 19B and 19C) which is 
associated with the signal detector (at least one of 
the signal detectors 7A, 8A and 9A) detecting the 
signal 16A undergone no change is displayed on the 

60 display unit 23 (step 40). 

The processing procedure illustrated in Fig. 4 is 
executed by the diagnosis units 2B and 2C as well. In 
response to application of the pulse-like test signals 
from the diagnosis units 2A, 2B and 2C, the signals 

65 a, b and c each containing the pulse-like test signal, 
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as is illustrated in Fig. 6, are outputted from the 
change-over switches SWA, SWB and SWC, respec- 
tively. In conjunction with Fig. 6, it will be noted that 
the control signals of logic "1" outputted from the 
control apparatuses 1A. 1B and 1C when the 
associated movable contacts 4D are connected to 
the stationary contacts 4A of the associated change- 
over switches SWA, SWB and SWC are omitted from 
illustration. The diagnosis units 2A, 2B and 2C 
operate asynchronously with one another to output 
the test signals S and the test command signals CH. 
Consequently, the signals a, b and c outputted from 
the associated change-over switches include the 
pulse-like test signals of different periods (i.e. the 
pulse-like test signals having different periods Ti, T2 
and T3) which are outputted from the diagnosis units 
2A, 2B and 2C, respectively. Each of the pulse-like 
test signals S is a pulse signal having such a duration 
To (not longer than 100 ms in the case of the instant 
embodiment) during which the devices to be 
controlled (i.e. the valves 13A to 13C in the case of 
the instant embodiment) can remain inoperative 
even when the signals a, b and c overlap one 
another, as indicated at a time point t3. The individual 
signals shown in Fig. 6 represent the state in which 
the pulse-like test signals outputted from the 
associated diagnosis units are applied through 
corresponding manipulation of the change-over 
switches, wherein the control signal of logic "V 
transmitted from the control apparatus when the 
movable contact 4D of the associated change-over 
switch is connected to the stationary contact 4A to 
which the abovementioned control apparatus is 
connected (i.e. the state intervening two successive 
pulse-like test signals) is omitted from illustration. 
Additionally, the individual signals shown in Fig. 6 
indicate the state in which the control signal of logic 
"1" is not outputted from the control apparatus 
between the two successive pulse-like test signals S 
(i.e. the state in which only the control signal of logic 
"0" is outputted). It should further be mentioned that 
the test signal of logic °0 W outputted at the step 31 is 
produced in precedence to the pulse-like test signal 
shown in Fig. 6. 

As will be seen in Fig. 6, the pulse-like test signal c 
is of the shortest period T3 among the signals a, b 
and c. The time interval (period T3) between two 
successive pulse-like test signals S in the signal c is 
so selected that a series of steps intervening 
between the step 35 being currently executed and 
the same step 35 to be executed at the next cycle in 
the procedure shown in Fig. 4 can be executed 
within this period T3. The test signal S and the test 
command signal CH shown in the step blocks 31 and 
35 in Fig. 4 are generated by an oscillator (omitted 
from illustration of the diagnosis unit shown in Fig. 3 
but shown in Fig. 8 as referred to later on) and 
outputted from the diagnosis unit at the time interval 
corresponding to a predetermined number of pulses 
as detected by a counter (not shown in Fig. 3 but 
described hereinafter in conjunction with another 
embodiment shown in Fig. 8). Inputting of the signals 
16A to 18A at the steps 32 and 32A is also performed 
at a time interval corresponding to a predetermined 
number of pulses detected by another counter (also 



not shown in Fig. 3). The outputs of the counters 
mentioned above are supplied to the CPU 25 by way 
of the data bus 30. 

Next, operation of the diagnosis unit for deciding 
5 the presence or absence of abnormality in the very 
diagnosis unit will be described. The signal a 
containing the pulse-like test signal S outputted 
from the diagnosis unit 2A periodically at the time 
interval T1 is detected by the signal detectors 7B and 

10 7C to be subsequently inputted to the diagnosis 
units 2B and 2C, respectively. Thus, the diagnosis 
unit 2B as well as 2C. can decide the presence or 
absence of abnormality in the diagnosis unit 2A by 
detecting whether the input signal a has changed its 

15 state from logic "0 B to logic "1 n or vice versa until the 
number of times the signals 16A to 18A were 
inputted has attained the predetermined number or 
count, as determined at the step 32A. As the 
abnormality of the diagnosis unit, there may be 

20 mentioned abnormality or malfunction of the ROM 
24, the CPU 25, the output circuit 27 and the data 
bus 30. It goes without saying that such abnormality 
of the diagnosis unit 2A can also be determined by 
the diagnosis unit 2A itself. The decision made at the 

25 step 38 that the number of times the signal were 
inputted has attained a predetermined value in turn 
. means that a predetermined time has lapsed after 
the pulse-like test signal S was outputted. In case no 
test signal is outputted from the diagnosis unit 2A, 

30 the signal detector 7A detects the output signal of 
the control apparatus 1 A to thereby input that signal 
to the diagnosis unit 2A, which is however incapable 
of deciding whether the signal incoming from the 
signal detector 7A is whether the test signal or the 

35 control signal. In this conjunction, it is noted in 
general that the control apparatus 1A continues to 
output the signal of logic "0" or alternatively logic "1 " 
in the steady state except for the transient state. 
Accordingly, abnormality of the diagnosis unit can 

40 be decided when the control signal outputted from 
the control apparatus 1 A is in the steady state. The 
foregoing holds true for the control apparatuses 1B 
and 1C and the diagnosis units 2B and 2C. 
Each of the diagnosis units according to the 

45 instant embodiment can detect the presence or 
absence of abnormality as well as the malfunctioning 
component in the majority decision circuits 10A to 
10C on the basis of the patterns illustrated in Fig. 5 
with the aid of the input signals 16A to 18A not only 

50 in the state where only the test signal S is outputted 
but also in the state where only the control signals 
are outputted from the control apparatus 1 A to 1 C as 
well as in the state where the control signals are 
issued as mixed with the test signal. 

55 The diagnosis units 2A to 2C according to the 
instant embodiment of the invention are arranged to 
output the test signal in place of the corresponding 
control apparatuses 1 A to 1C. With the aid of the test 
signal as outputted, the diagnosis units 2A, 2B and 

60 2C can be inputted with the detection signals 16A to 
18A constituting ail the patterns Nos. 1 to 8 
illustrated in Fig. 5, whereby decision can be made 
as to the presence or absence of abnormality in the 
majority decision circuits 10A to 10C for all the 

65 modes of the input signals thereto and hence the 
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proesence or absence of the abnormality in the 
individual logical elements constituting the majority 
decision circuits 10A to 10C. According to the 
instant embodiment of the invention, the decision as 
to the presence or absence of abnormality can be 
made by utilizing the output signals of the control 
apparatuses 1A to 1C as well. In that case, however, 
the abnormality decision can not be executed for all 
the patterns mentioned above because the forms of 
the output signals of the control apparatuses 1A to 
1C are limited inherentiy. 

Further, according to the instant embodiment of 
the invention, the triplex control system can be 
simplified with regard to the structure because of no 
necessity for providing any change-over switch 
between each majority decision circuit and each 
device to be controlled (i.e. the valve in this case) for 
the purpose of transmitting the output of the 
majority decision circuit to the relevant diagnosis 
unit rather than the valve upon occurrence of 
abnormality. 

Besides, by virtue of such arrangement that the 
three diagnosis units are provided, respectively, in 
association with the control apparatuses independ- 
ent of one another, the probability of the device 
subject to one another, the probability of the device 
to be controlled (e.g. valve) being influenced can be 
significantly lowered, even when the abnormal test 
signal is inputted to the majority decision unit upon 
occurrence of abnormality in one of the diagnosis 
units (failure or malfunction in at least one of the 
CPU 25, the bus 30, the output circuit 27 and the 
aforementioned counters although not shown in the 
case of the system under consideration or failure in 
at least one of a test signal generating means J1, a 
test command signal generating means J2, a 
counter J3 and output circuits J9, J10 and others 
described hereinafter in conjunction with Fig. 8). 
This advantageous feature is ascribable to such 
arrangement of the control system according to the 
instant embodiment that the diagnosis units are 
prevented from operating in a common mode to all 
the control apparatuses 1A to 1C, whereby one of 
the majority decision circuits is always supplied with 
two normal signals (i.e. the test signal outputted 
from the test signal generating means of the 
diagnosis unit and two of the control signals 
outputted from the two control apparatuses con- 
nected to the two corresponding change-over 
switches to which the output signals of the two 
diagnosis units suffering no abnormality are con- 
nected in the case of the instant embodiment). The 
bus 30, the output circuit 27 and the counters 
cooperate with each other to constitute a means or 
mechanism for applying the test signal for the 
abnormality diagnosis to the majority decision circuit 
which serves as the signal selecting circuit. 

According to the instant embodiment of the 
invention, the time width or duration T 0 of the 
pulse-like test signal S is so selected that the device 
to be controlled can not be activated. Thus, any 
failure in one of the diagnosis units could never lead 
to operation of the device under the control. 

Further, in the instant embodiment, the periods or 
time intervals at which the pulse-like test signals are 



outputted from the diagnosis units 2A, 2B and 2C, 
respectively, are previously so established as to 
differ from one another. Accordingly, various combi- 
nations of the pulse-like test signals S such as 
5 illustrated in Fig. 6 can be obtained, whereby the 
diagnosis with the various patterns shown in Fig. 5 
can be correspondingly facilitated. 

The abnormality decision for the majority decision 
circuits and the diagnosis units as described 

10 hereinbefore can be carried out regardless of 
whether the triplex control system is in the state 
capable of performing the control operation or in the 
state receiving maintenance and/or inspection. 
Since the individual diagnosis units as well as the 

15 control apparatuses operate in asynchronism with 
one another, occurrence of the common mode due 
to synchronization can be prevented positively, 
whereby the reliability is enhanced. 

Further, according to the instant embodiment of 

20 the invention, establishment of the various types of 
common modes can be avoided, which means that 
the reliability of the triplex control system can be 
significantly enhanced. 
In the foregoing description of the instant embodi- 

25 ment, it has been assumed that the valves 13A, 13B 
and 13C are opened in response to the signal of 
logic "1" while they are closed with the signal of logic 
"0". It should however be understood that the valves 
can be set to the open state in response to the signal 

30 of logic "0" while being closed with the signal of logic 
"1\ 

The majority decision circuit shown in Fig. 2 may 
be replaced by a majority decision circuit 10Ai 
shown in Fig. 7. Same holds true for the other 

35 majority decision circuits 10B and 10C. Referring to 
Fig. 7, the majority decision circuit 10Ai is con- 
stituted by three AND gates 6B t 6C and 6D and an 
OR gate 5D which is so arranged as to receive at the 
inputs thereof the outputs of the AND gates 6B, 6C 

40 and 6D. The signal detectors 12A, 12B and 12C 
detect the outputs of the AND gates 6B, 6C and 6D, 
respectively. The output terminal of the OR gate 5D 
is connected to the wiring conductor 20A. On the 
other hand, the wiring conductors 19A, 19B and 19C 

45 are connected to the input terminals of the AND 
gates 6B to 6C in such manner as shown in Fig. 7. 

When the outputs of three OR gates of the 
majority decision circuit 10A (Fig. 2) are so wired as 
to realize the function of AND gate (i.e. the AND gate 

50 based on the wired logic) for thereby replacing the 
AND gate 6A, the abnormality diagnosis is rendered 
unnecessary to the AND gate realized in the form of 
the wired logic. Consequently, the signal detector 
11A can be spared. 

55 Fig. 8 illustrates in a functional diagram the 
functions of the diagnosis unit 2A of the control 
system shown in Fig. 1. The following description 
made with reference to Fig. 8 applies valid to the 
diagnosis units 2b and 2C as well. In a diagnosis unit 

60 2A' representing functionally the diagnosis unit 2A, 
the pulses outputted from a pulse generating means 
J4 are counted by a counter means J3. When the 
number of the counted pulses has attained a first 
predetermined value, the counter means J3 pro- 

65 duces a signal to both of test signal generating 
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means J1 and test command signal output means 
J2. The test signal generating means J1 and the test 
command signal output means J2 respond to the 
Input of the abovementloned signal by outputting the 
test sjgnal S and the test command signal CH to the 
wiring conductors 21 A and 22A through the output 
means J9 and J10, respectively. The input means J8 
is supplied with the detection signals 16A to 18A in 
response to the signal produced when the number 
of pulses counted by the counting means J3 has 
attained a second predetermined count value. The 
detection signal 16A, 17A and 18A thus inputted are 
once stored in the memory means J7. The data 
carried by the detection signals 16A to 18A and 
stored in the memory means J7 are compared with 
the patterns illustrated in Fig. 5 by the abnormality 
decision means J5 for the majority decision circuit, 
whereby decision is made as to presence or 
absence of abnormality in the majority decision 
circuit 10. Further, the abnormality decision means 
J6 for the diagnosis unit detects whether there 
exists the signal 16A undergone no change among 
the three signals 16A inputted within a predeter- 
mined period. When the signal 16A remaining 
unchanged over the predetermined period is pres- 
ent, then the decision is made that the diagnosis unit 
of concern suffers abnormality, as described herein- 
before. The results of the abnormality decisions 
made by the abnormality decision means J5 and J6, 
respectively, are outputted to the display unit 23 
through the output means J11. The diagnosis units 
2B as well as 2C operate similarly to the operation of 
the diagnosis unit 2A' described above. 

In the processing procedure shown in Fig. 4 and 
executed by the CPU 25 of the diagnosis unit 2A, the 
function "output of the test signal" in the steps 31 
and 35 corresponds to that of the test signal 
generating means J1 , the function "output of the test 
command signal" in the steps 31 and 35 corre- 
sponds to that of the test command signal genera- 
ting means, the functions in the steps 33, 34, 36, 33A 
and 34A correspond to those of the abnormality 
decision means J5, and the function "count of the 
input pulse number" in the steps 37, 38, 39, 40 and 
32A correspond to the function of the abnormality 
decision means J6. To say in another way, the CPU 
25 is imparted with the functions of the various 
means mentioned above. It will further be seen that 
the RAM 26 of the diagnosis unit 2A corresponds to 
the memory means J7, the input circuit 28 corre- 
sponds to the input means J8, and the output circuit 
27 corresponds to the output means J9 to J11, 
respectively. A memory not shown but correspond- 
ing to the ROM is also provided (for the purpose of 
storing, for example, the patterns illustrated in 
Fig. 5). Since the diagnosis unit 2A' incorporates 
therein both the functions of the test signal 
generating means and the test command signal 
generating means, synchronization between these 
means can be easily realized. 

It should be added that the abovementloned 
various means of the diagnosis unit 2A' may be 
implemented in hardware structures. Needless to 
say, employment of the diagnosis unit 2A' of 
hardware structure in place of the diagnosis units 



2A, 2B and 2C shown in Fig. 1, respectively, can 
assure substantially same advantageous effects as 
those attainable with the embodiment of the control 
system shown in Fig. 1. 

5 Fig. 9 shows another exemplary embodiment of 
the triplex control system according to the present 
invention. This embodiment differs from the one 
shown in Fig. 1 mainly in respect that latch devices 
41 A, 41 B and 41C are provided. The following 

10 description will therefore be directed to these 
differences. 

The latch devices 41 A, 41 B and 41 C are im- 
plemented in the identical structure with one 
another. Accordingly, the structure of the latch 

15 device 41 A will be described in detail by referring to 
Fig. 10, being understood that the description 
applies valid to the other latch devices 41 B and 41 C. 
The latch device 41 is composed of latch circuits 42A 
to 42H and an AND gate 43. Each of the latch circuits 

20 42A to 42H may be realized in the form of a flip-flop. 
The latch circuit 42A is connected to the signal 
detector 7A. The latch circuit 42B is connected to 
the signal detector 8A. The latch 42C is connected to 
the signal detector 9A. The latch 42D is connected to 

25 the signal detector 12A. The latch 42E is connected 
to the signal detector 12B. The latch 42F is 
connected to the signal detector 12C. Finally, the 
latch circuit 42H is connected to the signal detector 
11 A. Additionally, the signal detectors 12A to 12C 

30 are also connected to the input terminals of the AND 
gate 43 which has an output terminal connected to 
the latch circuit 43G. The latch circuits 42A to 42C of 
the latch device 41 B are connected to the signal 
detectors 7B, 8B and 9B, respectively, while the 

35 latch circuit 42H is connected to the signal detector 
1 1 B. On the other hand, the latch circuits 42A to 42C 
of the latch device 41 C are connected to the signal 
detectors 7C, 8C and 9C, respectively, while the 
latch circuit 42H thereof is connected to the signal 

40 detector 11C. The latch circuits 42E to 42G of the 
latch devices 42E and 41 C, respectively, are con- 
nected to the signal detectors 12A to 12C in the 
manner similar to the latch device 41 A. 
The diagnosis units 2Ai, 2Bi and 2Ci each 

45 constituted by a microprocessor in the instant 
embodiment are substantially identical with the 
diagnosis units 2A, 2B and 2C of the preceding 
embodiment. Considering the diagnosis unit 2Ai 
shown in Fig. 11, this unit 2Ai differs from the 

50 diagnosis unit 2A in that a bus 30A is provided and 
that output means 27A to which wiring conductors 
3A, 21A, 22A, 44A and 45A are connected is 
provided. The wiring conductors 44A and 45A 
provided additionally are connected to each of the 

55 latch circuits 42A to 42H of the latch device 41 A. 
Similarly, the wiring conductors 44B and 45B 
connected to the output circuit 27A of the diagnosis 
unit 2Bi are connected to the latch circuits 42A to 
42H of the latch device 41 B. Further, the wiring 

60 conductors 44C and 45C connected to the output 
circuit 27A of the diagnosis unit 2Ci are connected 
to the latch circuits 42A to 42H of the latch device 
41 C. The output terminals of the latch circuits 41 A to 
41 H of the latch devices 41 A, 41 B and 41 C are 

65 connected to the input circuits 28 of the diagnosis 
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unit 2Ai, 2Bi and 2Ci, respectively. 

The functions of the latch devices 41 A, 41 B and 
41 C will be described by taking as an example the 
latch device 41A. The latch circuit 42A of the latch 
device 41 A is supplied with the detection signal 16A 
from the signal detector 7A connected thereto. 
When the input detection signal undergoes a 
change, an edge or transition of the change (e.g. 
from logic "0" to logic T) is made use of for holding 
the state of the detection signal after the transition. 
The latch circuit 42A stores the state of the 
detection signal fetched in response to the input of a 
load signal U described hereinafter. Further, the 
latch circuit 42A resets the signal stored therein to 
"0" in response to the input of a reset signal Ri 
supplied from the diagnosis unit 2Ai through the 
wiring conductor 44A. Such functions of the latch 
circuit 42A are equally imparted to each of the latch 
circuits 42B to 42H. The latch circuits 42B and 42C 
are supplied as the inputs thereto with the detection 
signals 16A generated by the signal detectors 8A 
and 9A f respectively. The latch circuits i2D to 42F 
and the AND gate 43 are supplied with the detection 
signals 17A from the corresponding signal detectors 
12A to 12C, respectively. Finally, the latch circuit 42H 
is supplied with the detection signal 18A generated 
by the signal detector 11 A. The output signal of the 
AND gate 43 is inputted to the latch circuit 42G. The 
detection signals 16A stored in the latch circuits 42A 
to 42C, the detection signals 17A stored in the latch 
circuits 42D to 42G, the signal outputted from the 
AND gate 43 and stored in the latch circuit 42 and 
the detection signal 18A stored in the latch circuit 
42H are supplied to the input circuit 28 of the 
diagnosis unit 2Ai. 

The ordinary control operation of the control 
system according to the instant embodiment is 
identical with that of the control system shown in 
Fig. 1. Due to the operations or actions of the 
diagnosis units 2Ai to 2Ci, the signals a, b and c 
containing the pulse-like test signals S as illustrated 
in Fig. 6 are outputted from the change-over 
switches SWA, SWB and SWC, respectively, as in 
the case of the embodiment shown in Fig. 1. The 
diagnosis units 2Ai, 2Bi and 2Ci operate in 
asynchronism with one another. 

The processing for diagnosis as executed by each 
diagnosis unit will be described by taking as example 
the operation of the diagnosis unit 2Ai, being 
understood that the diagnosis units 2Bi and 2Ci 
execute the processing in the same manner as the 
diagnosis unit 2Ai. The CPU 25 constituting a main 
part of the diagnosis unit 2Ai executes the process- 
ing in accordance with the processing procedures 
illustrated in Figs. 12 and 13 and stored in the ROM 
24. In this connection, it should be mentioned that by 
reading the signals 16A to 18A shown in Fig. 12 and 
13 as the signals 16B to 18B, the processing 
procedure shown in these figures also becomes 
pertinent to the diagnosis unit 2Bi. Simiarly, by 
reading the signals 16A to 18A as the signals 16B to 
18B, the processing procedure shown in Figs. 12 
and 13 is pertinent to the diagnosis unit 2Cl 

The CPU 25 executes a step 31 at first, as the 
result of which the test signal S of logic "0" is issued 



onto the wiring conductor 19A through the change- 
over switch SWA. This test signal S of logic "0" is 
transmitted to the majority decision circuits 10A to 
10C by way of the wiring conductor 19A. The signals 
5 b and c (each containing the test signal or the 
control signal outputted from the associated control 
apparatus) are outputted through the change-over 
switches SWB and SWC to be supplied to the 
majority decision units 10A, 10B and 10C, respec- 
10 tively. 

The detection signals 16A, 17A and 18A are 
inputted to the associated latch circuits 42A to 42F 
and 42H and the AND gate 43 incorporated in the 
latch device 41 A. When a change or transition takes 

15 place in the signals inputted to the latch circuits 42A, 
42D, 42F, 42G and 42H in response to the appear- 
ance of the test signal S of logic "0" on the wiring 
conductor 19A, the associated latch circuits men- 
tioned above store therein the updated (new) state 

20 of the signals undergone the change or transition. 
The updated signals stored in the respective latch 
circuits are then supplied to the input circuit 28 of 
the diagnosis unit 2Ai. On the other hand, the other 
latch circuits 42B, 42C and 42E supply to the input 

25 circuit 28 the stored signals as they. are, so long as 
the signal transmitted through the wiring conductors 
19B or 19C undergoes no change. 

At the step 32, the signals 16A, 17A and 18A are 
inputted to the CPU 25 to be stored in the RAM 26 

30 through the data bus 30. Subsequently, the CPU 25 
confirms (detects) that the signals 16A to 18A have 
been inputted and then outputs the reset signal Ri 
(step 46). The reset signal Ri is transmitted to the 
latch circuits 42A to 42H of the latch device 41 A 

35 through the wiring conductor 44A to clear the 
signals stored in the latch circuits 42A to 42H to be 
logically "0". 

Similarly to the case of the embodiment shown in 
Fig. 1, the input signals 16A to 18A are compared 

40 with the output patterns (Fig. 5) outputted by the 
majority decision circuit 10A in the normal state 
thereof at the step 33, being followed by a step 34 
where the presence or absence of abnormality in the 
individual components constituting the majority 

45 decision circuit 10A is decided. In case the decision 
at the step 34 results in the presence of abnormality, 
information of the abnormality (e.g. component 
suffering from failure) are supplied to the display unit 
23 (step 36). 

50 The diagnosis unit 2Ai receives at the input 
thereof the outputs from the latch circuits 42D, 42E 
and 42F and the output of the latch circuit 42G as the 
signal 17. The reason why the latch circuit 42G for 
storing the output of the AND gate 43 is provided 

55 can be explained as follows. The majority decision 
circuit 10A realized logically in the 2-out-of-3 voting 
configuration can output the signal of logic "1" only 
when the outputs of all the OR gates 5A to 5C 
assume the level of logic "1". Accordingly, the 

60 majority decision circuit 10A can never output the 
signal of logic "1" at the time points ti, X2 and t4 
shown in Fig. 6. It should however be noted that all of 
the latch circuits 42D to 42F store therein the signals 
of logic " 1" at the time point t4. This can be explained 

65 by the fact that the change-over switches SWA, 
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SWB and SWC output the respective test signals S 
which are deviated temporally from one another due 
to the processing executed by the individual diag- 
nosis units within an extremely short period T4 at the 
step 31, as is illustrated in Fig. 6. The latch circuits 
42d to 42f output the signal of logic " 1" at least at the 
time point t4. On the other hand, the latch circuit 42H 
stores the signal of logic w 0" at the time point t4. This 
is because the AND gate 6A of the majority decision 
circuit 10A issues the signa! of logic "0" during the 
period T4. As a consequence, the diagnosis unit 2Ai 
which receives as the inputs thereto only the outputs 
of the latch circuits 42A to 42F and 42H at the time 
point t4 will erroneously decide that the AND gate 6A 
operating normally suffers from abnormality. In order 
to exclude such erroneous decision, the AND gate 
43 and the latch circuit 42G are provided in the latch 
device 41. The AND gate 43 outputs the logic "1" 
only when the outputs of the OR gates 5A, 5B and 
5C are simultaneously logic "1". Consequently, the 
latch circuit 42G outputs the signal of logic "1 " to the 
diagnosis unit 2Ai when the OR gates 5A, 5B and 5C 
output simultaneously the signal of logic "1". When 
all of the latch circuits 42D, 42E and 42F output the 
signal of logic "1", the diagnosis unit 2Ai makes 
decision that abnormality is present in the majority 
decision circuit 10A, provided that the output of the 
latch circuit 42G is logic "1", while deciding the 
absence of abnormality when the output of the latch 
circuit 42G is logic "0". 

When it is decided at the step 34 that the majority 
decision circuit 10A is operating normally, the 
procedure proceeds to a processing step 47. At this 
step 47, decision is made as to whether all the 
output signals of the latch circuits 42A, 42B and 42C 
(i.e. the signals 16A at the step 37) are logic "0". 
When the decision at the step 47 results in "NO" 
(negative), the procedure proceeds to the process- 
ing at a step 35. Subsequently, the processings at 
the steps 32A, 46B, 37, 33A, 34A, 38 and 39 are 
executed sequentially. The processing at the step 
46B is same as that of the step 46. When it is decided 
at the step 39 that there exists the signal 16A 
undergone no change, the procedure proceeds to 
the step 40. Otherwise, the procedure proceeds to 
the step 31. 

In case all the three signals 16A are decided to be 
logic "O" at a step 47, the CPU 25 outputs a load 
signal U (step 48). This load signal U is supplied to 
the individual latch circuits of the latch device 41 A by 
way of the wiring conductor 45A. AH of the latch 
circuits constituting the latch device 41 A fetch to 
store therein the associated detection signals 16A, 
17A and 18A in response to the load signal U as 
inputted. The latch circuit 42G fetches the output of 
the AND gate 43. Subsequently, the step 32 is 
executed. The reason why the signals are forcibly 
fetched by the latch circuits in response to the load 
signal U can be explained as follows. In order to 
decide whether the individual logical components of 
the majority decision circuit 41 A operate normally or 
not even in the case where all of the three signals a, 
b and c are logic °0 D , the diagnosis unit 2Ai fetches 
the outputs of the latch circuits 42A to 42H in 
response to the load signal U. In other words, since 



the latch circuits 42A to 42H are cleared to the state 
of logic "0" by the reset signal Ri, the states stored in 
the latch circuits undergo no change so long as the 
detection signals 16A remain logic "0". Accordingly, 

5 there arises such possibility that the state where the 
outputs of all the latch circuits of the latch device 
41 A are logic "0" might be under the influence of the 
reset signal Ri rather than the detection signals 16A 
of logic °0\ Under the circumstances, through the 

10 forcive signal fetching by the latch circuits 42A to 
42H in response to the load signal U, decision as to 
the presence or absence of abnormality in the 
majority decision circuit 10A on the basis of the 
output of the individual latch circuits cleared in 

15 response to the reset signal can be avoided, while 
allowing the decision of the majority decision circuit 
10A to be executed only when all of the three signals 
16A are logic n 0\ 
After execution of the step 32B, the steps 46A, 

20 33B and 34B are executed, wherein the same 
processings as those at the steps 46, 33 and 34 are 
performed. The processing at the step 47A is 
performed in the same manner as the step 47. When 
the result of the step 47A as executed is "YES", the 

25 processing starting from the step 48, inclusive 
thereof, is repeated. On the other hand, when the 
result of the decision made at the step 47A is "NO", 
the procedure succeeding to the step 32A, inclusive 
thereof, is executed. 

30 With the instant embodiment of the invention, 
similar advantageous effects to those of the embodi- 
ment shown in Fig. 1 can be obtained. Besides, by 
virtue of the provision of the latch device capable of 
latching the outputs of the individual signal detec- 

35 tors, the test signals S outputted asynchronously by 
the diagnosis units operating asynchronously can be 
fetched simultaneously. In other words, notwith- 
standing that the individual diagnosis units operate 
asynchronously, the abnormality decision of the 

40 given one of the majority decision circuits can be 
accomplished with high reliability on the basis of the 
test signals generated simultaneously through co- 
operation of the other diagnosis units. 
When a predetermined time required for the 

45 influence of the clearing by the reset signal Ri to 
become null (i.e. the time required for the signal of 
logic "0° or logic °1 a to be inputted to the latch 
circuit after the clearing) has elapsed in succession 
to the processing at the step 46, the step 35 may 

50 then be executed. In this case, a series of process- 
ings at the steps 47 to 47A described above are 
rendered unnecessary, whereby the processing 
procedure can be correspondingly simplified. 
The signal detector 11A and the latch circuit 42H 

55 may be spared by replacing the AND gate 6A by the 
wired logic AND gate as in the case of the 
embodiment shown in Fig. 1. 

Fig. 14 illustrates the function of the diagnosis unit 
2Ai of the embodiment shown in Fig. 9. The 

60 diagnosis unit 2Ai representing functionally the 
diagnosis unit 2Ai differs from the diagnosis unit 2A' 
illustrated in Fig. 8 in that the reset signal output 
means J12, the signal (16A) identifying means J13 
for outputting the load signal U and the output 

65 means J14 are added to the diagnosis unit 2A' 
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illustrated in Fig. 8. The diagnosis unit 2Bi and 2Ci 
are equivalent to the diagnosis unit 2Ai' with regard 
to the function. 

When each of the majority decision circuits 10A, 
10B and 10C of the embodiment shown in Fig. 9 is 
replaced by the majority decision circuit 10Ai shown 
in Fig. 7, it is then required to construct each of the 
latch devices 41 A, 41 B and 41 C in the structure of 
the latch device 49 shown in Fig. 15. This latch 
device 49 includes latch circuits 42! to 42K and AND 
gates 40A, SOB and 50C in place of the latch circuit 
42G and the AND gate 43 in the latch device 41 A. 
Operation or function of the latch device will be 
elucidated, assuming, by way of example, that the 
latch device 49 is employed for the latch device 41 A. 
The AND gate 50A receives as the inputs thereto the 
output signals of the signal detectors 7A and 8A. The 
AND gate 50B receives the output signals of the 
signal detectors 8A and 9A. The AND gate 50C 
receives the output signals of the signal detectors 
7A and 9A. The output of the AND gate 50A is 
inputted to the latch circuit 42I. The output of the 
AND gate SOB is inputted to the latch circuit 42J. The 
output of the AND gate 50C is inputted to the latch 
circuit 42K. On the other hand, the outputs of the 
latch circuits 42I to 42K are inputted to the diagnosis 
unit 2Ai. Further, the latch circuits 42I to 42K are 
supplied as other inputs thereto with the reset signal 
Ri and the load signal U through the wiring 
conductors 44A and 45A. The latch circuits 42D, 
42E, 42F are supplied as inputs thereto with the 
output signals of the signal detectors 12A, 12B and 
12C shown in Fig. 7, respectively. At the time point t4 
shown in Fig. 4, the signal a is logic "1" while the 
signals b and c are logic *0\ However, all of the latch 
circuits 42A, 42B and 42C store therein logic "1" at 
that time point t4. The latch circuits 42A to 42C 
output the respective signals of logic "I" to the 
diagnosis unit 2Ai at the time point T4. Conse- 
quently, the diagnosis unit 2Ai will decide that the 
AND gates 6B to 6C of the majority decision circuit 
10Ai suffer from abnormality. With a view to 
preventing such erroneous decision, there are 
provided the latch circuits 42I, 42H and 42K as well 
as the AND gates 50A, SOB and 50C similarly to the 
aforementioned latch circuit 42G and the AND gate 
43. The diagnosis unit 2Ai performs the abnormality 
decision for the majority decision circuit 10Ai on the 
presumption that the logic "0" outputs of the latch 
circuits 42A and 42B are true when the output of the 
latch circuit 421 is logic "1", the logic "1" outputs 
from the latch circuits 42B and 42C are true when the 
output of the latch circuit 42J is logic "1 " and that the 
logic "1" outputs of the latch circuits 42A and 42C 
are true when the output of the latch circuit K is logic 

a .j n 

Another embodiment of the triplex control system 
according to the present invention will now be 
described by referring to Figs. 16, 17 and 18. Fig. 16 
shows a control apparatus IA2 producing the signal 
a as the output thereof in association with a majority 
decision circuit 10A and a diagnosis unit 2A3. It will 
however be readily appreciated that the control 
apparatuses outputting the signals b and c are also 
provided in association with the corresponding 



majority decision circuits and diagnosis units, re- 
spectively, in the same manner as shown in Fig. 16. 
In the case of the instant embodiment, the output 
signals Si to Sn of the individual sensors are directly 

5 inputted to the control apparatus IA2. 

Fig. 17 shows a hardware structure of the control 
apparatus IA2. As will be seen in this figure, the 
control apparatus IA2 includes a CPU 55B, a RAM 
55C, a ROM 55D, input circuits 55A and 55F, output 

10 circuits 55E and 55G and a bus 55H for interconnect- 
ing these components. The control apparatuses IB2 
and IC2 are also implemented in the same structure. 
The diagnosis unit 2A3 shown in Fig. 18 is substan- 
tially identical with the diagnosis unit 2A described 

15 hereinbefore in conjunction with Fig. 3. The diag- 
nosis unit 2A3 differs from the latter 2A in that 
external wiring conductors 3A and 75 are connected 
to the output circuit 27 in the case of the diagnosis 
unit 2A3. 

20 The CPU 25 of the diagnosis unit 2A3 executes the 
processing in accordance with the procedure illus- 
trated in Fig. 20, while the CPU 55B of the control 
apparatus IA2 executes the processing procedure 
illustrated in Fig. 19. The processing procedure of 

25 Fig. 20 is also executed by the other diagnosis unit 
as well. Similarly, the processing procedure shown 
in Fig. 19 is also executed by the other control 
apparatuses. 
The CPU 25 of the diagnosis unit 2A3 outputs a 

30 ' test command signal CH at a step 35A. This test 
command signal CH is inputted to the RAM 55C of 
the control apparatus IA2 by way of the wiring 
conductor 75. 
The CPU 55B of the control apparatus IA2 

35 executes the processing of a step 59. More 
specifically, the CPU 55B decides whether the test 
command signal CH has been inputted or not. Upon 
inputting of the test command signal CH, decision at 
the step 59 results in "YES" (affirmative), being 

40 followed by the execution of a step 76. In other 
words, the pulse-like test signal including as alter- 
nate sequence of "0", "1" and "0" is outputted as the 
signal a. The time width or duration of the pulse-like 
test signal is represented by T 0 as in the case of the 

45 embodiment shown in Fig. 1. In succession to the 
outputting of this test signal, the test command 
signal CH stored in the RAM 55C is erased (step 67) 
for the purpose of preventing the pulse-like test 
signal from being frequently outputted under the 

50 command of the test command signal CH stored in 
the RAM 55C. When the sensor output signals Si to 
Sn are inputted to the control apparatus 1A2, the 
CPU 55B executes the processing steps 60, 61A, 
62A, 63 and 64. 

55 After execution of the step 35A, the CPU 25 of the 
diagnosis unit 2A3 executes the processing steps 
32A, 37, 33A, 34A, 38 and 39 described herein 
before. Additionally, the aforementioned step 36 or 
40 may be executed, as occasion requires. 

60 According to the instant embodiment of the 
invention, there can be obtained the effects similar 
to those of the embodiment shown in Fig. 1. In 
particular, it must be pointed out that the probability 
of influence of failure at least in one of the CPU 55B 

65 of the control apparatus 1 A2 (i.e. function of the test 
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signal generating means K2 shown in Fig. 21), the 
CPU 25 of the diagnosis unit 2A3, the bus 30 and the 
output circuit 27 (i.e. functions of the test command 
signal output means J2, the counter J3 and the 
output means J10) to the device to the controlled is 
decreased. The diagnosis abnormality decision 
circuit J4 decides the abnormality in the test signal 
generating circuit K2, the test command signal 
outputting circuit J2, the counter J3 and the output 
circuit J10 on the basis of whether the test signal 
undergoes or not a change within a predetermined 
time duration. 

Fig. 21 shows a control apparatus IA2' and a 
diagnosis unit 2A3' which represent functionally the 
control apparatus IA2 and the diagnosis unit 2As, 
respectively. The other control apparatuses and 
diagnosis units perform respective functions in the 
similar manner. The diagnosis unit 2A3' differs from 
the diagnosis unit 2A' shown in Fig. 8 in that the test 
signal generating means J1 and the output means J9 
of the latter are omitted and that the controller 
abnormality decision means J15 is provided as in the 
case of the diagnosis unit 2Ai. The control means 
IA2' includes a control signal generating means K1 
(corresponding to steps 60, 61 A, 62A, 63 and 64), a 
test signal generating means K2 (corresponding to a 
step 76) and a change-over means K3 (correspond- 
ing to a step 59). The test signal generating means 
K2 receives as the input thereto the test command 
signal CH and outputs the test signal. The change- 
over means K3 performs the switching operation in 
response to the test command signal CH. The 
control apparatus or controller in each of the 
embodiments described hereinbefore includes the 
control signal generating means K1. However, the 
test signal generating means K2 and the change- 
over means K3 are not incorporated. 

Fig. 22 shows still another embodiment of the 
triplex control system according to the invention. 
The triplex control system of the instant embodiment 
corresponds to the system shown in Fig. 1 in which 
only one 10A of the three majority decision circuits 
10A, 10B and 10C is employed. The device subject to 
the control is only one valve 13. The control 
apparatuses (controllers) 1A, 1B and 1C are pro- 
vided in one-to-one correspondence with the diag- 
nosis units 2A, 2B and 2C, respectively. The 
detection signals 16A of the signal detectors 7A, 8A 
and 9A provided on the input side of the majority 
decision circuit 10A, the detection signals 17 of the 
signal detectors 12A, 12B and 12C incorporated in 
the majority decision circuit 10A and the detection 
signal 18A of the signal detector 1 1 A provided on the 
output side of the majority decision circuit 10A are 
branched and inputted to the diagnosis units 2A, 2B 
and 2C, respectively. 

Each of the diagnosis units 2A to 2C executes the 
same processing as shown in Fig. 4. The instant 
embodiment can equally provide the advantageous 
effects as in the case of the embodiment shown in 
Fig. 1. 

In this manner, the teachings of the present 
invention can be equally applied to the case where 
only one device is subject to the control. 

Parenthetically, it should be mentioned that in the 



embodiment shown in Fig. 19, the latch devices 41 A, 
41 B and 41 C may be provided similarly to the 
embodiment shown in Fig. 9. 
Next, a quadrupiex control system according to a 

5 further embodiment of the present invention will be 
described by reference to Figs. 23, 24 and 25. The 
quadrupiex control system is applied to a nuclear 
reactor protection or safeguard system in a nuclear 
power plant. The arrangement of this control system 

10 is essentially identical with that of the system shown 
in Fig. 1 except that a control apparatus (controller) 
10, a change-over switch SWD, a majority decision 
circuit 10D3, a diagnosis unit 2D7, signal detectors 
7D, 8D f 9D and 83A to 83D and wiring conductors 

15 19D and 22 are additionally provided because of the 
quadruplexing. Reference characters 84A to 84D 
designate excitation coils for actuating valves 13A to 
13D, respectively. Although the excitation coils 84A 
to 84D are shown separately from the associated 

20 valves 13A to 13D in Figs. 23 and 24, is will readily be 
understood that they are assembled together in 
reality. The control apparatus 10 is of the same 
structure as the apparatus 1A, 1B or 1C and serves 
for the same function as the latter. The change-over 

25 switch SWD serves for the same function as the 
switch SWA, SWB or SWC. The wiring conductor 
connected to the stationary contact 4C of the 
change-over switch SWD is connected to the 
majority decision circuits IOA3 to 10D3, respectively. 

30 The signal detectors 83A, 83B, 83C and 83D detect 
the signal carried by the wiring conductor 19D on the 
input sides of the associated majority decision 
circuits, respectively. The signal detectors 7D t 8D 
and 9D detect the signal transmitted through the 

35 corresponding wiring conductors 19A to 19C on the 
input side of the majority decision circuit IOD3 
similarly to the signaJ detectors 7A, 8 A and 9A. 

Connected to the stationary contacts of the 
change-over switches SWA to SWD are the wiring 

40 conductors 82A to 82D, which are grounded, as is 
shown in Fig. 23. These wiring conductors 82A to 
82D function as the test signal generating means for 
supplying the test signals S of logic n 0" to the 
associated majority decision circuits, respectively, 

45 whenever the associated change-over switches 
assume the state in which the stationary contacts 4B 
and 4C are connected to each other. 

Fig. 24 shows a structure of the majority decision 
circuits IOA3 to IOD3 each implemented in the from 

50 of a 2-out-of-4 voting logic configuration. The 
majority decision circuit IOA3 includes relays (or 
contactors) 85A to 85H constituting the switch 
means, signal detectors 86A to 86F, an AND gate 89 
realized by a wired logic and wiring conductors 87A 

55 to 87D. The relays 85A, 85B and 85C and 85D are 
disposed in series and interconnected by the wiring 
conductor 87A. The relay 85E, 85F, 85G and 85H are 
also disposed in series and mutually connected by 
the wiring conductor 87B. The wiring conductor 87C 

60 connects the portion of the wiring conductor 87A 
located between the relays 85A and 85B and the 
portion of the wiring conductor 87B located between 
the relays 85E and 85F to each other. On the other 
hand, the wiring conductor 87D connects the portion 

65 of the wiring conductor 87A located between the 
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relays 86B and 85C to the portion of the wiring 
conductor 87B located between the relays 85F and 
85G. The wiring conductors 87A and 87B are 
connected together and hence connected to a 
power supply source 88. The wiring conductor 87A 
has the other end connected to the other end of the 
wiring conductor 87B to thereby realize the AND 
gate 89 in the form of a wired logic. The AND gate 89 
in turn is connected to the wiring conductor 20A. In 
the case of the instant embodiment, the wired logic 
AND gate 89 is provided in each of the majority 
decision circuits IOA3 to IOD3. whereby the 
necessity for providing the signal detectors 11 A to 
11C in the wiring conductors 20A to 20D, respec- 
tively, as in the case of the embodiment shown in 
Fig. 1, is avoided. 

Now, description will be turned to the disposition 
of the signal detectors 86A to 86F within the majority 
decision circuit IOA3. The signal detectors 86A to 
86F are contactless sensors as with the case of the 
signal detectors 7A to 9A. The signal detector 86A is 
provided for the wiring conductor 87A at a location 
between the junction of the wiring conductors 87C 
and 87A and the relay 85A. The signal detector 86B 
is provided for the wiring conductor 87A at a location 
between the junction of the wiring conductors 87D 
and 87A and the relay 85B. The signal detector 86C 
is provided in association with the wiring conductor 
87A between the relay 85D and the AND gate 89. The 
signal detector 86E is provided in association with 
the wiring conductor 87B at a location between the 
junction of the wiring conductor 87C and 87B and 
the relay 85E. The signal detector 86F is provided for 
the wiring conductor 87B at a location between the 
junction of the wiring conductors 87D and 87B and 
the relay 85F. The signal detector 86F is provided for 
the wiring conductor 87A at a location between the 
relay 85H and the AND gate 89. 

The signal a is applied to the relay 85A and 85C by 
way of the wiring conductor 19A. The signal b is 
applied to the relays 85B and 85G through the wiring 
conductor 19B. The signal c is applied to the relays 
85E and 85D through the wiring conductor 19C. The 
signal d is applied to the relays 85F and 85H through 
the conductor 19D. Each of the relays 85A to 85H is 
opened when the associated one of the signals a to 
d is logic "0" while being closed when the associated 
signal is logic "1 \ When two or more of the signals a 
to d assume the logic "0" level, connection of the 
excitation coil 84A to the power supply source 88 is 
broken by the opening of the contact of the 
associated relay, resulting in that the excitation coil 
84A is brought to the deenergized state to open the 
valve 13A. When three or more of the signals a to d 
assumes the logic n Y level, interconnection bet- 
ween the excitation coil 84A and the power supply 
source 88 is established by the associated relay 
contact being closed, whereby the excitation coil 
84A is electrically energized to close the valve 13A. 

A 2-out-of-4 logic circuit corresponding to the 
structure of the majority decision circuit IOA3 in 
which the signal detectors 86A to 86F are omitted is 
disclosed in a Japanese publication entitled "Hand- 
book of Nuclear Engineering" published by Ohm Sha 
Ltd. (Nov. 30. 1976), p. 264, Table 9.6. The logic of 



the 2-out-of-4 logic circuit of this majority decision 
circuit is given by the following expression: 

Z « abc + bed + cda + dab (1) 

5 

where Z represents the output of the AND gate 86, 
and a to d represent the values of the corresponding 
signals a to d. 
Each of the majority decision circuits 1 0A3 to IOD3 

10 is a sort of signal selecting device for selecting such 
a signal from a plurality of input signals which is to 
operate the device subject to the control, to thereby 
output an actuation signal therefor similarly to the 
majority decision circuits 10A to 10C shown in Fig. 1. 

15 However, the majority decision circuits IOA3 to IOD3 
differ from the majority decision circuits 10A to 10C 
shown in Fig. 1 in that the signal selected from the 
four input signals (signals a to d) is not outputted 
intact as the actuation signal. In other words, in the 

20 case of the majority decision circuits according to 
the instant embodiment of the invention, the relays 
85A to 85H select the signal for operating the device 
(e.g. valve) subject to the control, whereupon the 
signal differing from the selected input signal a, ... or 

25 d (e.g. current from the power supply source 88) is 
outputted as the actuation signal for the device 
under the control. 

The detection signals detected by the signal 
detectors 86A to 86F are supplied to the input circuit 

30 28 (Fig. 25) of the diagnosis unit 2A7 through 
separate wiring conductors. This input circuits 28 is 
also supplied with the detection signals of the signal 
detectors 7A to 9A and 83A. In Figs. 23 and 24, the 
latter detection signals are collectively designated 

35 by I6A2 while the former detection signals are 
collectively designated by 17A2. Further, reference 
characters I6B2 to I6D2 designate the detection 
signals outputted from the signal detectors 7B to 9B, 
83B, 70 to 9C, 83C, 7D to 9D and 83D. Reference 

40 characters 17B2 to 17D2 designate the detection 
signals of the signal detectors 89A to 86F in the 
majority decision circuits IOB2 to IOD2. 

Each of the diagnosis units 2A7 to 2D7 is 
implemented in a structure shown in Fig. 25 and 

45 substantially identical with the diagnosis unit 2A 
shown in Fig. 3. 

The abnormality diagnosing function of the instant 
embodiment will be described below. The diagnosis 
units 2A7 to 2D7 are each designed to perform the 

50 same function. Accordingly, in the following, the 
contents of processing executed by the diagnosis 
unit 2A7 will be elucidated, by way of example. The 
CPU 25 of the diagnosis unit 2A7 reads out the 
processing procedure illustrated Fig. 26 from the 

55 ROM 42. At first, in a step 35A, the test command 
signal CH is outputted. In response to this test 
command signal CH, the change-over switch SWA 
change-overs the state in which the control appara- 
tus 1A is connected to the wiring conductor 19A to 

60 the state where the wiring conductors 82A serving 
as the signal generating means is connected to the 
conductor 19A. As a consequence, the test signal S 
of logic "1" is transmitted to the wiring conductor 
19A from the conductor 82A. The control apparatus 

65 1 A supplied with the sensor signal outputs the signal 
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of logic "1 " in the normal state where the valve 13A is 
held in the closed state. This signal of logic n 1" is 
transferred to the wiring conductor 19A by way of 
the switch SWA so long as no test command signal 
CH is outputted. When the valve 13A is to be closed, 
the control apparatus 1A outputs the signal of logic 
"0". Since the diagnosis units 2A7 to 2D? operate 
asynchronously with one another, the test signals S 
outputted from the wiring conductors 82A to 82D to 
the corresponding wiring conductors 19A to 19D in 
response to the test command signal CH have such 
periods T1 to T4 as illustrated in Fig. 27, respectively. 
These periods T1 to T4 can be adjusted by the 
previously mentioned counters incorporated in the 
diagnosis units 2A7 to 2D7. Upon interrupt of the 
output of the test command signal CH from the 
diagnosis unit 2A7, the signal of logic "1" outputted 
from the control apparatus 1A is transmitted to the 
wiring conductor 19 similarly to the original state. 
The pulse width T 0 during which the signal of logic 
"O" is outputted is so determined that the valve 13A 
is prevented from being actuated, as with the case of 
the duration To of the pulse-like test signal illustrated 
in Fig. 6 for the control system shown in Fig. 1 . 

After the step 35A, the signals I6A2 and 17A2 are 
inputted to the CPU 25, the number of these input 
signals being counted (step 32B). At a step 37C, 
change in the four inputted signals I6A2 is detected, 
wherein the signal I6A2 undergone the change is 
stored in the RAM 26. At a step 33H, the input 
signals I6A2 and 17A2 are compared with the normal 
signal patterns shown in Fig. 29. Subsequently, 
decision is made as to the presence or absence of 
abnormality in the majority decision circuit IOA3. 
Fig. 28 shows, listing in a table, the relays which can 
be detected individually by the signal detectors 86A 
to 86F. The signal detectors 86A to 86F are designed 
to detect the current. When the relay 85A, for 
example, is closed, a current flows through the 
signal detector 86A. On the other hand, when the 
relay 85A is opened, no current flows through the 
signal detector 86A. Each signal detector produces 
the output signal of logic "1 " when the current flows 
through the associated relay, while producing the 
output signal of logic "0" when no current flows 
through the associated relay. When the patterns of 
the input signals I6A2 and 17A2 differ from the 
normal signal patterns shown in Fig. 29, it is decided 
that the majority decision circuit IOA3 suffers 
abnormality or malfunction, whereupon the process- 
ing at the step 36 is executed. Discrepancy in the 
pattern resulting from the pattern comparison 
indicates that abnormality occurs in the associated 
relays listed in the rightmost column in the table 
shown in Fig. 29. Needless to say, the relays are 
logical elements constituting parts of the majority 
decision circuit IOA3. 

When the decision at the step 34A results in the 
absence of abnormality, decision is then made at a 
step 90 whether breaking of wire occurs in the 
excitation coil 84A. If the outputs of all the signal 
detectors 86A to 86F are logic n 0" in the state where 
all the outputs of the signal detectors 7A to 9A and 
83A are logic "1", it is then decided that breaking of 
wire takes place in the excitation coil 84A, being then 



followed by execution of the processing at the step 
36. When the decision at the step 90 results in "NO", 
a step 38 is executed whereupon the processing 
succeeding to the step 35A is repeated. On the 

5 other hand, when the result of decision made at the 
step 38 is "YES", the procedure proceeds to the 
processing of the step 39B, where decision is made 
as to the abnormality of another diagnosis unit in the 
manner similarly to the step 39 (Fig. 4). 

10 In the case of the instant embodiment, the latch 
devices described hereinbefore in conjunction with 
Fig. 9 and 10 can be employed. 

The quadruplex control system according to the 
instant embodiment can bring about the similar 

15 advantageous effects to those of the system shown 
in Fig. 1. However, when compared with the system 
shown in Fig. 1 in which the function of the signal 
generating means is imparted to the microcomputer 
constituting the diagnosis unit 2A or the system 

20 including the control apparatus connected in the 
manner shown in Fig. 16, the quadruplex control 
system requires that the signal generating means be 
provided separately and independent of the diag- 
nosis unit and the control apparatus, involving a 

25 structure complicated more or less as compared 
with the triplex control system on the whole. 

Fig. 30 is a view illustrating functionally the 
quadruplex control system according to the instant 
embodiment. By way of example, the diagnosis unit 

30 2A, can be functionally implemented as indicated by 
a block 2A7'. This diagnosis unit 2A7' is substantially 
identical with the diagnosis unit 2A3' shown in Fig. 21 
with regard to the function. The former differs from 
the latter only in that the test signal generating 

35 means (the grounded wiring conductor 82A shown 
in Fig. 23) G and the change-over switch (change- 
over) SWA are provided externally of the control 
apparatus 1 A2, wherein the test command outputted 
from the test command signal output means J2 is 

40 inputted to the change-over switch SWA rather than 
the test signal generating means G. In this connec- 
tion, it should be appreciated that these functions of 
the test signal generating means G and the 
change-over switch SWA of the diagnosis unit 2AV 

45 can also be applied to the triplex control system 
described hereinbefore in conjunction with Fig. 1 
and others. 

There is known a dual-solenoid type nuclear 
reactor protecting system having an enhanced 

50 reliability. In this system, a single valve 13A is 
provided with a pair of excitation coils 84A and 84A' 
so that the valve 13 A is opened only when both the 
excitation coils are deenergized, as is shown in 
Fig. 31. The teaching of the present invention can 

55 equally be applied to the abnormality decision for a 
majority decision circuit IOA4 provided in associ- 
ation with the dual-solenoid valve, which circuit 10A 4 
may then be composed of the majority decision 
circuit IOA3' having the same structure as the circuit 

60 IOA3. 

Further, the teaching of the present invention can 
be applied to a duplex control system as well. 
Besides, the invention can also be applied not only 
to a multiplexed control system designed to output 
65 analogue control signals but also to a multiplex 
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control system equipped with an intermediate value 
selecting circuit employed as the signal selector 
(corresponding to the majority decision circuits in 
the various systems described hereinbefore) to 
which the abovementioned control signal is applied. 
In this case, however, it is necessary to change the 
latch circuit (for example, Fig. 10; 41A to 41H) to a 
sample-hold circuit receiving the input signals to 
determine any abnormality of the intermediate value 
selecting circuit by comparing magnitude of the 
signals. 



Claims 



1 . A multiplex control system, comprising : 

a plurality of test signal generating means (J1, 
J2) provided, respectively, in correspondence 
with a plurality of control apparatuses (1) 
installed in parallel with one another, for 
producing respective test signals for diagnosis 
of abnormality; 

at least one signal selecting means (10) for 
selecting from the signals produced by said 
plurality of control apparatuses (1 ) a signal for 
operating a device (13) under control; and 
a plurality of diagnosis units (2) for deciding the 
presence or absence of abnormality in said 
signal selecting means (10) on the basis of the 
signals inputted to said signal selecting means 
and the signal outputted therefrom. 

2. A multiplex control system according to 
claim 1, wherein said signal selecting means 
(10) is so arranged as to output an actuation 
signal for operating said device (13) under 
control, when a predetermined number of 
signals of those outputted from said plurality of 
control apparatuses (1) Indicate that said 
device (13) under control is to be operated. 

3. A multiplex control system according to 
claim 1, or claim 2,wherein said diagnosis unit 
(2) includes said test signal generating means 
(J1.J2) 

4. A multiplex control system according to 
any one of claims 1 to 3, wherein said diagnosis 
unit (2) operate asynchronously with one an- 
other. 

5. A multiplex control system, comprising: 

a plurality of test signal generating means (J1. 
J2) provided, respectively, in correspondence 
with a plurality of control apparatuses (1) 
installed in parallel with one another, for 
producing respective test signals for diagnosis 
of abnormality; 

at least one signal selecting means (10) for 
selecting from the signals produced by said 
plurality of control apparatuses (10) a signal for 
operating a device (13) under control; and 
a plurality of diagnosis units (2) each including 
first abnormality decison means for deciding 
presence or absence of abnormality in said 
signal selecting means (10) on the basis of the 
signals inputted to said signal selecting means 



(10) and the signal outputted therefrom and 
second abnormality decision means for decid- 
ing presence or absence of abnormality in the 
other diagnosis units on the basis of at least 
5 one of said signals inputted to said signal 

selecting means. 

6. A multiplex control system, comprising: 

a plurality of test signal generating means (J1, 
J2) provided, respectively, in correspondence 
10 with a plurality of control apparatuses (1) 

installed in parallel with one another, for 
producing respective test signals for diagnosis 
of abnormality; 

at least one signal selecting means (10) for 
15 selecting from the signals produced by said 

plurality of control apparatuses (10) a signal for 
operating a device (13) under control; 
latch devices (41 ) including memory means for 
storing the signals inputted to said signal 
20 selecting means (10) and those of the signals 

outputted from said signal selecting means 
which have undergone a change; and 
a plurality of diagnosis means (2) for deciding 
presence or absence of abnormality in said 
25 signal selecting means (10) on the basis of said 

signals stored in said latch means (41). 

7. A multiplex control system according to 
claim 6, wherein said diagnosis means includes 
means for outputting a reset signal to said 

30 memory means of said latch device (41) upon 

reception of said input signal and said output 
signal to and from said signal selecting means 
(10). 

8. A multiplex control system according to 
35 any one of the preceding claims which includes 

said plurality of control apparatuses (1 ), each of 
said control apparatuses including control sig- 
nal generating means (K1) for outputting a 
control signal on the basis of an output signal of 
40 a sensor and test signal generating means (K2) 

for producing a test signal for diagnosis of 
abnormality. 

9. A multiplex control system, comprising: 

a plurality of control apparatuses (1) disposed 
45 in parallel with one another, each for producing 

a control signal on the basis of an output signal 
of a sensor; 

a plurality of test signal generating means 
(J1.J2) provided, respectively, in correspond- 

50 ence with said plurality of control apparatuses 

(1), for producing respective test signals for 
diagnosis of abnormality; 
at (east one signal selecting means (10) includ- 
ing a plurality of logical elements (5,85) for 

55 receiving signals outputted from said plurality of 

control apparatuses thereby to select an opera- 
ting signal for operating a device (13) under 
control from said received signals and output 
said operating signal upon selection thereof; 

60 a plurality of first signal detecting means (7, 8, 9) 

for detecting individually all the signals inputted 
to said signal selecting means; 
a plurality of second signal detecting means 
(11, 12) for detecting individually the outputs of 

65 said logical elements ; 
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a plurality of diagnosis units (2) provided in 
correspondence with said control apparatuses 
(1), each of said diagnosis units (2) including 
abnormality decision means (J5) for deciding 
the presence or absence of abnormality in said 5 
signal selecting means (10) on the basis of the 
outputs of test command signal generating 
means (J2) outputting a test command signal 
and the outputs of said first and second signal 
detecting means (7, 8, 9, 1 1 , 12) ; and 10 
a plurality of signal change-over means (SW) for 



transmitting said test signal to said signal 
selecting means (10) in response to the input of 
said test command signal. 

10. A multiplex control system according to 
claim 9, wherein said signal selecting means 
(10) outputs said operating signal when a 
predetermined number of the signals of those 
outputted from said plurality of control appara- 
tuses (1) indicate that said device (13) under 
control is to be operated. 
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